Към съдържанието
Търсене

CVE-2026-74688: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead of being transmitted immediately. If the peer transport is removed while the chunk is still queued, sctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing, but only clears cached transport pointers in out_chunk_list. The queued control chunk therefore retains a dangling transport pointer. Once an ASCONF_ACK clears the suppression and the queued control chunk is transmitted, SCTP dereferences the stale transport pointer, leading to a use-after-free. Fix this by also clearing chunk->transport for queued control chunks in control_chunk_list when removing the transport.

Засегнати продукти

  • Linux Linux: 8a07eb0a50aebc8c95478d49c28c7f8419a26cef преди dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886; 8a07eb0a50aebc8c95478d49c28c7f8419a26cef преди fad4766a74220fe579c6fcaa10ba01c23529814f; 8a07eb0a50aebc8c95478d49c28c7f8419a26cef преди 936658ec41c28c397ef390140e02d4c91ade92f0; 8a07eb0a50aebc8c95478d49c28c7f8419a26cef преди 8de65194a04d2552cd39b6c67d942d490f22d174; 8a07eb0a50aebc8c95478d49c28c7f8419a26cef преди 6160e756db81d6cb63e3e2952efcf6c5134be385; 8a07eb0a50aebc8c95478d49c28c7f8419a26cef преди 18d704bdd809377dfd81a3c2f42426763b5da227; 8a07eb0a50aebc8c95478d49c28c7f8419a26cef преди 4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7; 8a07eb0a50aebc8c95478d49c28c7f8419a26cef преди c9158ceaf27780ef64534ad72f44ffde3f8ccc49
  • Linux Linux: 3.1; преди 3.1; 5.10.265 до 5.10.*; 5.15.216 до 5.15.*; 6.1.183 до 6.1.*; 6.6.152 до 6.6.*; 6.12.104 до 6.12.*; 6.18.45 до 6.18.*; 7.1.9 до 7.1.*; от 7.2 нататък

История

  • 22 август 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-74688: Linux | freedomonline.bg